Denial of Service and DDoS

A Denial of Service (DoS) attack attempts to make a system or network resource unavailable to legitimate users by overwhelming it with traffic or exploiting vulnerabilities that crash the service.

DoS originates from a single source. DDoS (Distributed DoS) uses thousands or millions of compromised devices (botnets) or amplification to generate attack traffic. DDoS is much harder to block because the source is distributed globally.

Volumetric attacks flood the target's bandwidth with raw traffic:

• UDP floods — spoofed UDP packets saturate bandwidth
• ICMP floods — ping packets overwhelm the target
• DNS amplification — small DNS queries return large responses to victim

Measured in Gbps — some attacks exceed 1 Tbps.

Protocol attacks exploit weaknesses in network protocols:

• SYN flood — sends thousands of TCP SYN packets, exhausting server connection tables
• Ping of Death — sends oversized ICMP packets that crash vulnerable systems
• Smurf attack — spoofed ICMP sent to network broadcast, all hosts reply to victim

Application layer (Layer 7) attacks target specific application functions with legitimate-looking requests:

• HTTP flood — sends millions of GET/POST requests
• Slowloris — sends partial HTTP headers slowly, occupying all server connections
• SSL exhaustion — abuses TLS handshake CPU cost

Amplification exploits protocols that return much more data than requested:

• DNS amplification: 60x amplification factor
• NTP amplification: 556x amplification factor
• Memcached amplification: 51,000x amplification factor (2018: 1.7 Tbps attack)

Attackers spoof victim's IP as source — reflectors send huge responses to victim.

Scrubbing centers are specialized infrastructure that absorb and filter DDoS traffic before it reaches the target. Major providers (Cloudflare, Akamai, AWS Shield) have hundreds of Tbps of scrubbing capacity.

Application-level defenses:

• Rate limiting per IP/user
• CAPTCHA challenges for suspicious traffic patterns
• Connection throttling
• IP reputation blocking (known botnet IPs)

Anycast distributes attack traffic across multiple global data centers. Instead of one target absorbing all traffic, the load is spread. Cloudflare and other CDNs use anycast to handle massive volumetric attacks.

DDoS is commonly used as a cyberwarfare tool. Major incidents:

• 2007 Estonia — government and banking sites knocked offline during political crisis
• 2022 Ukraine — Ukrainian government sites targeted during Russian invasion
• Hacktivists using DDoS for political statements

Organizations can test resilience with authorized load testing tools:

• siege — HTTP load testing
• ab (Apache Bench) — simple HTTP benchmarking
• Commercial stress testing services (with authorization)

Never test systems you do not own or have written permission for.

Which attack type sends incomplete HTTP headers very slowly to occupy all available server connections?

DoS/DDoS attacks deny service by overwhelming targets with traffic or exploiting protocol weaknesses. Attack types include volumetric (UDP/DNS floods), protocol (SYN flood), and application layer (Slowloris, HTTP floods). Defenses include scrubbing centers, anycast, rate limiting, and CAPTCHA. Amplification attacks multiply attack power by exploiting reflectors.